SSL/TLS Client Authentication

Go/src/crypto/tls/common.go:289

// ClientAuth determines the server's policy for
// TLS Client Authentication. The default is NoClientCert.
ClientAuth ClientAuthType

// ClientAuthType declares the policy the server will follow for
// TLS Client Authentication.
type ClientAuthType int

const (
   // NoClientCert indicates that no client certificate should be requested
   // during the handshake, and if any certificates are sent they will not
   // be verified.
   NoClientCert ClientAuthType = iota
   // RequestClientCert indicates that a client certificate should be requested
   // during the handshake, but does not require that the client send any
   // certificates.
   RequestClientCert
   // RequireAnyClientCert indicates that a client certificate should be requested
   // during the handshake, and that at least one certificate is required to be
   // sent by the client, but that certificate is not required to be valid.
   RequireAnyClientCert
   // VerifyClientCertIfGiven indicates that a client certificate should be requested
   // during the handshake, but does not require that the client sends a
   // certificate. If the client does send a certificate it is required to be
   // valid.
   VerifyClientCertIfGiven
   // RequireAndVerifyClientCert indicates that a client certificate should be requested
   // during the handshake, and that at least one valid certificate is required
   // to be sent by the client.
   RequireAndVerifyClientCert
)

The Ultimate Guide to SSL/TLS Client Authentication: Know How it Works https://aboutssl.org/ssl-tls-client-authentication-how-does-it-works/